Malicious code in baby-loris (npm)

Source: ossf-package-analysis 9155edd098ee3fed04541b192087704f5a42b1f149bdd0f4f487d7e0ae941870 The OpenSSF Package Analysis project identified 'baby-loris' @ 1.0.2 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. --...

Spyware for Babies

The New York Times has a long article alt link on surveillance systems aimed at babies. They are increasingly using AI. Nanit and its rivals want to own 24/7 health tracking for the sub-four-foot set. And their already astonishing levels of baby data collection are just the beginning. Nanit...

Baby FTP Service - Detect

Baby FTP service was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Baby FTP service was detected.""" import socket from kittysploit import from lib.protocols.tcp.tcpscannerclient import Tcpscannerclient class ModuleScanner, Tcpscannerclient: info = 'name': 'Baby FTP Service - Detect',...

abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2026-57516 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2026-57516 Source advisory: OSV:GHSA-HHRP-GW25-JR43...

aliby (>=0.1.18, <=0.1.55), aliby-baby (>=0.1.11, <=0.1.17) +36 more potentially affected by CVE-2022-35972 via tensorflow (2.9.0)

tensorflow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - aliby =0.1.18, =0.1.11, =0.30.0, =0.0.13, =0.1.0, =0.0.0, =1.3.0, =0.3.0, =1.2.0, =0.0.6, =0.0.9 - gcvit-tensorflow 1.2.1 - genericsnn 1.0.1...

aliby (>=0.1.18, <=0.1.55), aliby-baby (>=0.1.11, <=0.1.17) +36 more potentially affected by CVE-2022-36004 via tensorflow (2.9.0)

tensorflow PYPI version 2.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - aliby =0.1.18, =0.1.11, =0.30.0, =0.0.13, =0.1.0, =0.0.0, =1.3.0, =0.3.0, =1.2.0, =0.0.6, =0.0.9 - gcvit-tensorflow 1.2.1 - genericsnn 1.0.1...

abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2023-6019 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2023-6019 Source advisory: OSV:PYSEC-2026-519...

abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2023-48022 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2023-48022 Source advisory: OSV:PYSEC-2026-517...

abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2025-62593 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2025-62593 Source advisory: OSV:PYSEC-2026-520...

Malicious code in @coterie-baby/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0f46407e3ad7d060630b7aec9ce77a68f41c3a9fd3678941d6d43ca78b68a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-5654 Malicious code in @coterie-baby/common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb0f46407e3ad7d060630b7aec9ce77a68f41c3a9fd3678941d6d43ca78b68a6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in @coterie-baby/common

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-33361

In Meari IoT SDK image handling libmrplayer.so as observed in CloudEdge 5.5.0 build 220, Arenti 1.8.1 build 220, and related white-label apps = 1.8.x, baby monitor ".jpgx3" files use reversible XOR over only the first 1024 bytes with a predictable key derivation model...

Meari IoT SDK encryption vulnerability

Meari IoT SDK is a software development kit provided by Meari Corporation, aimed at developing applications for smart devices. There are encryption-related vulnerabilities in the Meari IoT SDK. These vulnerabilities stem from the use of a predictable key derivation method to perform reversible XO...

abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2026-41486 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2026-41486 Source advisory: OSV:PYSEC-2026-2272...

abmarl (>=0.2.0, <=0.2.2), aliby (0.1.16) +5 more potentially affected by CVE-2026-32981 via ray (1.4.0)

ray PYPI version 1.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on ray and may be impacted: - abmarl =0.2.0, =0.1.4, =1.3.0, =1.4.10, =2021.6.22.dev0, =2021.7.1.dev0 Source cves: CVE-2026-32981 Source advisory: OSV:GHSA-J3MH-QMJJ-XP83...

CVE-2026-28062

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through = 1.2.12...

EUVD-2026-9722

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through = 1.2.12...

CVE-2026-28062 WordPress Happy Baby theme <= 1.2.12 - Local File Inclusion vulnerability

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through = 1.2.12...

CVE-2026-28062

Improper Control of Filename for Include/Require Statement in PHP Program 'PHP Remote File Inclusion' vulnerability in ThemeREX Happy Baby happy-baby allows PHP Local File Inclusion.This issue affects Happy Baby: from n/a through = 1.2.12...